The Internet provides users with convenient and ubiquitous access to digital content. Because the Internet is a powerful distribution channel, many mobile devices strive to directly access the Internet. The mobile device may include a mobile telephone, smart phone, tablet, mobile hotspot, or any other device that is capable of accessing a mobile network. The use of the Internet as a distribution medium for copyrighted content creates the compelling challenge to secure the interests of the content provider. Increasingly, mobile devices operate using a processor loaded with suitable software to render (playback) digital content, such as audio and/or video. Control of the playback software is one way to enforce the interests of the content owner including the terms and conditions under which the content may be used. Previously many mobile devices were closed systems. Today more and more platforms are partially open. Some users may be assumed to have complete control over and access to the hardware and software that provides access to the content and a large amount of time and resources to attack and bypass any content protection mechanisms. In the case of mobile devices with subscriber identity module (SIM) cards, the attacker does not have control of the SIM card. As a consequence, content providers must deliver content to legitimate users across a hostile network to a community where not all users or mobile devices can be trusted.
Typically, digital rights management systems use an encryption technique based on block ciphers and a encryption/decryption key that process the data stream in blocks using a sequence of encryption/decryption steps, referred to as rounds. During each round, a round-specific function is performed. The round-specific function may be the same round function in each round but each round may use a different round-specific sub-key. For many encryption systems, the round function may be specified using mapping tables or look-up tables. Frequently tables are used for different parts of the function for efficient execution in software of encryption/decryption functions. Look-up tables may be implemented that combine multiple functions of the round. Further, instead of distributing user-specific keys, user-specific algorithms that incorporate a user-specific key may be distributed instead of keys for encryption or decryption algorithms. These algorithms have to be obfuscated (hidden) in order to prevent redesign or prohibit obtaining the user-specific key. Accordingly, the encryption/decryption function may be carried out using tables accompanied with some computer code.
Content providers must deliver content to legitimate users across a hostile network to a community where not all users or devices can be trusted. This has lead to the development of white-box cryptography. In the white-box cryptography scenario it is assumed that the user has complete control of the hardware and software that provides access to the content, and an unlimited amount of time and resources to attack and bypass any content protection mechanisms. The secure software code that enforces the terms and conditions under which the content may be used should be tamper resistant. The general approach in digital rights management for protected content distributed to mobile devices is to encrypt the digital content using for example, DES (Data Encryption Standard), AES (Advanced Encryption Standard), or using other known encryption schemes, and to use decryption keys to recover the digital content.
The two main areas of vulnerability of digital rights management relying on encryption are the software modules which enforce the terms and conditions under which the content may be used, and the key distribution and handling. Typically, the software module enforces the terms and conditions under which the content is to be used. An attacker aiming to bypass these terms and conditions may attempt to achieve this through tampering of the program code of the software module.
Regarding key distribution, a media player has to retrieve a decryption key from a license database in order to play back the media. The media player then has to store this decryption key somewhere in memory for the decryption of the encrypted content. This leaves an attacker two options for an attack on the key. First, an attacker may reverse engineer the license database access function allowing the attacker to retrieve asset keys from all license databases. In this situation the attacker does not need to understand the internal working of the cryptographic function. Second, the attacker may observe accesses of the memory during content decryption, thus the attacker may retrieve the decryption key. In both cases the key is considered to be compromised.
The widespread use of DRM has given rise to the need for secure, tamper-resistant software seeks to complicate tampering with the software, but various other applications may require the use of secure, taper-resistant software as well. Various techniques for increasing the tamper resistance of software applications exist. Most of these techniques are based on hiding the embedded knowledge of the application by adding a veil of randomness and complexity in both the control and the data path of the software application. The idea behind this is that it becomes more difficult to extract information merely by code inspection. It is therefore more difficult to find the code that, for example, handles access and permission control of the secure application, and consequently to change it.
As used herein, white-box cryptography includes a secure software application that performs cryptographic functions in an environment where an attacker has complete control of the system running the white-box cryptography software. Thus, the attacker can modify inputs and outputs, track the operations of the software, sample and monitor memory used by the software at any time, and even modify the software. Accordingly, the cryptographic functions need to be carried out in a manner that prevents the disclosure of secret information used in the cryptographic functionality. Further, the cryptographic functions carried out by the white-box cryptography system are any type of cryptographic function, for example, encrypting/decrypting data using symmetric or asymmetric methods, executing hash functions, calculating digital signatures, performing key exchange protocols, performing authentication protocols, etc. White-box cryptography functions may be implemented in various ways. Such methods include: obscuring the software code: using complex mathematical functions that obscure the use of the secret information: using look-up tables: or any other methods that carry out cryptographic functions but hide the secret information needed for those cryptographic functions. Typically a white-box implementation will also contain components to bring anti-debugging and tamper-proofing properties.